Anubis Ransomware Hackers Deploy New Lindnor Backdoor and 13 Security

Cybersecuritynews •Kavichselvan • November 9, 2026

Attackers using Anubis ransomware broke into a U.S. organization in October 2026. They used a new custom backdoor called Lindnor and dropped at least 13 tools built to switch off security software. Symantec’s Protection Bulletin says the encryption payload was blocked before it could run. Anubis ransomware Lindnor backdoor Symantec tracks the developer of Anubis […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Anubis Ransomware Uses New Lindnor Backdoor in U.S. Attack In October 2026, attackers using Anubis ransomware targeted a U.S. organization, deploying a new custom backdoor named Lindnor alongside at least 13 tools designed to disable security software. The attack was characterized by the presence of the Lindnor backdoor on two Microsoft SQL Server machines, where it disguised itself as a Chrome component and a VMware file. Symantec reported that the encryption payload was blocked before execution, and there is no evidence that any files were encrypted during the incident. The attack is linked to the Hawkmoth group, which has claimed approximately 96 victims in the past year, with a significant portion located in the U.S. The initial access method for the attackers remains unidentified, and the incident highlights the increasing sophistication of ransomware tactics. 4 sources 40

Extracted Entities

Anubis Ransomware Hackers Deploy New Lindnor Backdoor and 13 Security

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Ransomware Groups (1)